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Dear Sir: 

Appellant requests review of the rejections presented in the Final Office Action dated 
August 14, 2009 for the above-identified application. No amendments are being filed with this 
request. This request is being filed with a Notice of Appeal. The review is requested for the 
reason(s) stated below. 



Claims 1-5 and 7-40 are pending in the present application. All claims stand rejected under 
35 U.S.C. § 102(e) as being unpatentable over U.S. Patent No. 6,941,271 to Soong (hereinafter 
"Soong"). Appellant respectfully submits that the outstanding claim rejections are improper, and 
thus requests pre-appeal brief review of the rejected claims in light of the remarks presented herein. 



Soong fails to teach various claim limitations, as detailed below. 

A. Receiving and Storing Access Keys 

Independent claim 1 recites, in part, "receiving, by a key organization system operable on 
a computer processor, a first access key . . . ; receiving, by said key organization system, a second 
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access key storing the first and second access keys in a centralized key repository that is 
communicatively accessible by said key organization system " (emphasis added). Independent 
claim 12 recites "receiving, by the key organization system from a first patient using a client 
computer, a first access key . ..; receiving, by the key organization system from a second patient 
using a second client computer, a second access key . . . ; storing, by said key organization system, 
the first and second access keys and said association in a centralized key repository " (emphasis 
ad Jed). -■ . e;:.\: ;A..i ': 35 recites "receive, from a patient at a key organization system, a first 

access key receive, from said patient at said key organization system, a second access key 
store the first and second access keys in a centralized key repository" (emphasis added). 
Independent claim 36 recites "a key organization system to: store a plurality of provider- 
associated access keys on a centralized key repository , wherein said plurality of provider-associated 
access keys comprise a first access key that grants a patient-defined level of access to the first set of 
medical records and a second access key that grants a patient-defined level of access to the second 
set of medical records" (emphasis added). Soong fails to teach at least the above-emphasized 
limitations of claims 1, 12, 35, and 36. 

The Office Action likens Soong' s password to the claimed "access keys." Office Action at 2. 
However, Soong does not teach a key organization system that receives and stores access keys. 
Soong" s distribution of passwords does not teach the limitation. Specifically, Soong teaches that 
the patient can provide the password to others. Soong at col. 6, Ins. 50-54. However, in Soong, the 
distributed passwords are not taught as stored in any intermediary system (e.g. a key organization 
system). Rather, after the passwords are distributed in Soong, it becomes the responsibility of the 
individual recipients of such passwords to keep track of the passwords and to input the passwords 
when accessing the medical records. Soong at col. 6, Ins. 49-59. As such, Soong does not teach a 
key organization system receiving and storing access keys. Therefore the rejection of claims 1, 12, 
35, and 36 should be withdrawn for at least the above reasons. 

B. Associating Access Keys 

Claim 1 recites "associating, by said key organization system, said first and second access 
keys with said medical service provider". Claim 12 recites "associating, by said key organization 
system, said first and second access keys to said medical service provider . . . storing, by said key 
organization system, the first and second access keys and said association in a centralized key 
repository A ;? :A:/a A; recites "a first access key associated with a medical service provider that 
grants to said medical service provider a patient-defined level of access to the first set of medical 
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records . . . [and] a second access key associated with said medical service provider that grants to 
said medical service provider a patient-defined level of access to the second set of medical 
records' 5 . Claim 35 recites "a first access key associated with a first medical service provider that 
grants to said first medical service provider a first patient-defined level of access to a first set of 
medical records . . . [and] a second access key associated with a second medical service provider 
that grants to said second medical service provider a second patient-defined level of access to said 
first set of medical records". Claim 36 recites ; *a plurality of provider-associated access keys 
Soong fails to teach at least the above limitations, as discussed below. 

Soong" s passwords are not associated with a medical provider. In Soong, the patient merely 
provides his password to whomever (e.g. family members, friends, health care professionals), and 
any of those individuals use that same patient password to access the medical records. Soong at 
col 6, Ins. 5-6, 50-54. Thus, while the password may define certain access rights that are presumed 
by the system as being granted to the individual inputting the password, the system does not 
associate the password with any medical service provider. For instance, the system makes no 
determination of whether a given password has been granted to a particular medical service 
provider (or other user) who is requesting access to the medical records, but instead merely requires 
the requestor to input the password. Therefore the rejection of claims 1 , 12, 28, 35, and 36 should 
be withdrawn for at least the above reasons. 

C. Receiving and Associating Different Access Keys from the Same Patient with 
Different Providers 

Claim 34 recites "receive, at said key organization system, a first access key that grants to a 
first medical service provider a first patient-defined level of access to a first set of medical records 
of a corresponding patient; [and] receive, at said key organization system, a second access key that 
grants to a second medical service provider a second patient-defined level of access to said first set 
of medical records of said corresponding patient" (emphasis added). Claim 35 recites "receive, 
from a patient at a key organization system, a first access key associated with a first medical service 
provider that grants to said first medical service provider a first patient-defined level of access to a 
first set of medical records ; [and] receive, from said patient at said key organization system, a 
second access key associated with a second medical service provider that grants to said second 
medical sendee provider a second patient-defined level of access to said first set of medical 
records " (emphasis added). Soong fails to teach the above limitations of claims 34 and 35. 
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Just as Soong does not teach a key organization system receiving or associating an access 
key with a particular provider as explained above, Soong does not teach a key organization system 
receiving or associating different access keys from the same patient which are associated with 
different providers. Therefore, the rejection of claims 34 and 35 should be withdrawn. 

D. The Key Organization System Uses the Access Keys to Control Access 

Claim 19 recites "responsive to a request received from, a medical service provider to 
access one of said sets of medical records, retrieving, by a key organization system, from said 
centralized key repository a determined one of said access keys that is associated with said medical 
service provider and which corresponds to said requested set of medical records, and controlling, 
by said key organization system, access by said medical service provider to said requested set of 
medical records using the retrieved access key" (emphasis added). Claim 28jecites "wherein the 
key organization system is configured to, responsive to receipt of a request from the medical 
service provider to access one of said first and second set of medical records, retrieve a determined 
one of the first and second access keys from the centralized key repository and use the retrieved 
access key to control access by said medical service provider to said requested set of medical 
records " (emphasis added). Claim 34 recites "responsive to a request received from one of said 
first and second medical service providers to access said first set of medical records, retrieve from 
said centralized key repository a determined one of said access keys that is associated with said 
requesting medical service provider, and using the retrieved access key to grant to the requesting 
medical service provider the corresponding patient-defined level of access to said first set of 
medical records" (emphasis added). Claim 36 recites "responsive to a received request from a 
provider to access one of said first and second sets of medical records, retrieve from said 
centralized key repository a respective one of said first and second access keys that grants the 
requesting provider a patient-defined level of access to the requested one of said first and second 
sets of medical records; and use said retrieved access key to grant said requesting provider the 
corresponding patient-defined level of access to the requested one of said first and second sets of 
medical records" (emphasis added). 

Soong does not teach the above limitations of claims 19, 28, 34, and 36. Rather than 
retrieving and using a key from a centralized key repository, Soong requires a requesting user (e.g., 
physician) to input a password that is used for controlling access to the medical records. Therefore, 
the rejection of claims 19, 28, 34, and 36 should be withdrawn for this further reason. 
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E. Provides . cccsscs MedkrJ Recorc s vdtkai i In uuCiig Ike Access Key 

Independent claim 12 recites "receiving, by said key organization system, a request from 
said medical service provider to access said first or second set of medical records and, responsive to 
said request, controlling access to said requested set of medical records using said first or second 
access key, wherein input of said first or second access key from said medical service provider is 
not required by said key organization system " (emphasis added). Claim 35 recites "receive a 
request from said first medical service provider to access said first set of medical records; and 
retrieve, responsive to said request, said first access key from said centralized key repository to 
pro vide said first medical service provider with access to said first set of medical records wherein 
input of said first access key from said first medical service provider is not required by said key 
organization system " (emphasis added). 

Soong does not allow a service provider to access medical records without first inputting a 
password. Soong at col. 6, Ins. 20-25. Rather, Soong requires that the patient's password be 
entered by the individual person requesting the medical records before access to the records will be 
provided. Soong at col. 6, Ins. 20-25. As such, Soong does not teach the above limitations of 
claims 12 and 35, and thus the rejection of these claims should be withdrawn for this further reason. 



Therefore, the outstanding claim rejections should be overturned as improper. Appellant 
thus respectfully requests that the panel reverse the outstanding rejection of claims. If a fee is due 
with this response, please charge our Deposit Account No. 50-3948 under Order No. 
66729/P032US/1 06 14704 from which the undersigned is authorized to draw. 



Conclusion 



Dated: September 2, 2009 
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